Google dismantles XCPE botnet: 1.3 million Android TV devices compromised by Chinese manufacturer

Google announced on Monday (November 3) the dismantling of the XCPE botnet, a malicious infrastructure operating on more than 1.3 million Android TV devices — predominantly set-top boxes manufactured by Chinese company Videostrong Technology Co. The case is notable for revealing a rare business model in cyberspace: rather than exploiting vulnerabilities in third-party systems, the manufacturer itself installed a backdoor into the firmware during production and operated it as a service for cybercriminals.

A weaponized manufacturing supply chain

Unlike most botnets that infect devices through software vulnerabilities or social engineering of users, XCPE was born infected. According to the Google Threat Intelligence Group (GTIG) report, Videostrong deliberately developed a persistent backdoor residing in the `/oem/` partition of the device firmware — a storage area reserved for the operating system and accessible even after the user reinstalls the system.

The malware's architecture was modular and three-tiered: a primary backdoor responsible for C2 (command and control) communications, a loading mechanism that executed additional modules, and a monetization system enabling third-party affiliates to profit from the compromised devices.

Videostrong didn't just install the backdoor; it also sold access to the control system to external operators. This "infrastructure-as-a-service" dynamic turns the manufacturing chain itself into an attack vector, a pattern security researchers call "badbox" — devices sold legally that simultaneously deliver legitimate functionality and remote-control capability.

How XCPE operated

Compromised XCPE devices behaved no differently from legitimate ones. The malware used an MQTT broker (a lightweight machine-to-machine communication protocol) hosted on subdomains of `anyevonline[.]com`, with secondary communication via `mqtt.szbboys[.]com`. This was a deliberate choice: MQTT is widely used in legitimate IoT devices, making the remote control traffic indistinguishable from normal connected device communications.

Once controlled, the devices could:

- Silently download and install new Android applications; - Disable Google Play Protect; - Execute shell commands with system privileges; - Capture screenshots and inject keystrokes; - Collect account information, device details, installed app lists, and system logs; - Perform network reconnaissance and establish reverse shells; - Act as residential proxies for malicious traffic.

The botnet spread across more than 170 countries, with significant concentrations in Malaysia, Brazil, Iraq, Mexico, and Taiwan — markets where low-cost Android set-top boxes are particularly popular.

Evolution and evasion

Over two years, Videostrong continuously evolved the malware's architecture to bypass Google's security checks. Rather than trying to spoof the Android compatibility tests (which manufacturers must pass to obtain Google certification), the company used obfuscation techniques to exploit a gap in those tests: it loaded the malicious code after the device's first boot, when validation testing had already been completed.

From late 2024, Videostrong began using a separate loader called `com.abc.nexus`, which executed malicious modules while XCPE focused exclusively on C2 communication. Starting in August 2026, operators migrated to even smaller droppers disguised as Android system applications, making detection increasingly difficult.

Google's response

The disruption operation involved Japan's National Police Agency, Lumen Technologies, Human Security, Plume, Synthient, and TrendAI. Measures included:

- Legal action to take down C2 domains and servers; - Permanent ban of Videostrong and its subsidiaries from Android certification; - Modification of the certification review process to detect similar activities (without public details, to avoid assisting future evaders); - Takedown of C2 domains used by more than a dozen other malware families that leveraged the XCPE backdoor as a vehicle — cutting access to at least 10 million additional devices from various manufacturers.

Google did not remove the malware from already infected devices. If a user attempts to remove it, the malware automatically reinstalls itself from the `/oem/` partition. The only solution is to install clean firmware or disconnect the device from the internet.

The resilient market behind the botnet

The most important warning in Google's report isn't about Videostrong — it's about the market sustaining operations like XCPE. The GTIG accurately identified the systemic nature of the business behind it:

> "We believe our actions have seriously impacted over a dozen malicious actors," Google wrote. "But the underlying market for backdoors, ad fraud, and residential proxies is resilient. Backdoor operators, ad fraud rings, and residential proxy providers operate as an interconnected supply chain — when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs."

This is the central lesson. XCPE wasn't an isolated attack by a sophisticated actor; it was a legitimate business in the sense that it had supply chains, customers, and recurring revenue. Videostrong sold access to criminals the way legitimate companies sell hardware. The difference is that the product was the ability to remotely control a million devices.

What happens when IoT device security regulations become so stringent that manufacturers begin circumventing them not through negligence, but through deliberate decision? XCPE shows exactly that scenario: the manufacturability of the attack is not a security accident; it is the model itself. And as long as the backdoor-as-a-service market remains profitable — which Google confirmed by noting 10 million additional devices exploited by other malware families through the same infrastructure — XCPE will be the first in a long line of source-fabricated botnets.

Sources: Google Cloud Blog, BleepingComputer, CyberScoop, SecurityWeek

✓ Independent sources cross-checked and verified before publishing